Senior Cybersecurity Engineer

Business Unit: Information Technology Industry: No Industry Overview Houlihan Lokey, Inc. (NYSE:HLI) is a leading global investment bank recognized for delivering independent strategic and financial advice to corporations, financial sponsors, and governments. With uniquely deep industry expertise, broad international reach, and a partnership approach rooted in trust, the firm provides innovative, integrated solutions across mergers and acquisitions, capital solutions, financial restructuring, and financial and valuation advisory. Our unmatched transaction volumes provide differentiated, data-driven perspectives that help our clients achieve their most critical goals. To learn more about Houlihan Lokey, please visit HL.com. About The Team We believe that as we grow individually, we also grow as an Information Technology team allowing us to contribute to the overall growth of Houlihan Lokey. We embrace challenges and try new things, always looking for ways to improve. We deliver technology products and services enabled everywhere, so business can happen anywhere. We like where we work, who we work with, and what we do. We cultivate a culture where we all thrive. Description: Information security sits at the center of how Houlihan Lokey protects client trust and operates as a global financial institution. As a Senior Information Security Engineer, you help ensure that the technology powering the firm's business is defended against evolving threats — work that matters more with every new regulation, adversary, and client expectation the industry takes on. You will join the global security team in defending a complex, distributed enterprise environment that spans multiple regions, business lines, and regulatory jurisdictions. We are looking for a versatile security generalist with hands-on experience securing endpoints, networks, identity systems, cloud infrastructure, and applications — someone equally comfortable architecting a control as they are leading the response to a live incident. Strong incident response experience is a significant asset for this role; penetration testing exposure is a plus. It's an ideal opportunity for an experienced engineer who wants to help shape the security posture of a global financial institution and build a career at the intersection of technology, security, and financial services, inside a team that will invest in your growth from day one. Key Responsibilities: - Design, implement, and maintain security controls across endpoints, servers, network infrastructure, cloud platforms (e.g., Azure/GCP), and identity systems (e.g., Active Directory, Entra ID, SSO/MFA). - Act as a senior responder for security incidents: lead triage, investigation, containment, eradication, and post-incident review, and help mature the firm's incident response playbooks, tooling, and processes globally. - Monitor, tune, and improve detection capabilities across SIEM, EDR, network security monitoring, email security, and cloud security posture management tools. - Partner with IT infrastructure, application development, and business teams to embed security into new projects, deployments, and M&A-related technology integrations (e.g., deal room environments, data rooms, client-facing platforms). - Conduct vulnerability management activities, including scanning, prioritization, remediation tracking, and reporting across a global, multi-office environment. - Lead and continuously improve identity and access management practices, including privileged access management (PAM), least-privilege enforcement, and access reviews. - Design and enforce data protection controls to safeguard confidential client information, deal data, and material non-public information (MNPI), including DLP, encryption, and secure collaboration tooling. - Support and help scope internal and external penetration testing and red team engagements, including remediation validation and retesting. - Contribute to third-party/vendor risk assessments, particularly for vendors supporting sensitive deal-related workflows. - Support regulatory and compliance efforts relevant to global financial services (e.g., FCA, FINRA, SEC, GDPR, MAS, DFS 500-series, and similar regional regulations) as they pertain to information security controls. - Develop and maintain security documentation, standards, and runbooks; mentor junior engineers and contribute to security awareness initiatives for a globally distributed workforce. - Participate in an on-call rotation supporting a follow-the-sun security operation across US, European, Middle Eastern, and Asia-Pacific offices. Qualifications & Experience: Required - Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent practical experience. - 7+ years of experience in an information security engineering, security operations, or systems/network security role, ideally within financial services, professional services, or another regulated industry. - Demonstrated, hands-on incident response experience — leading or playing a senior role in investigations, containment, and remediation of real-world security incidents. - Broad experience securing enterprise environments, including two or more of the following domains: endpoint security and EDR; network security (firewalls, segmentation, IDS/IPS, VPN); identity and access management/privileged access management; cloud security (AWS, Azure, or GCP); email and collaboration security (O365/M365, Google Workspace); application and API security. - Solid understanding of the threat landscape facing financial institutions, including phishing/BEC, insider threats, and data exfiltration risks tied to confidential deal information. - Practical experience with SIEM platforms, log analysis, and security monitoring/alert triage. - Working knowledge of vulnerability management processes and tools (e.g., Tenable, Qualys, Rapid7). - Strong scripting/automation skills (e.g., Python, PowerShell, Bash) for tool integration and process improvement. - Excellent communication and interpersonal skills, with the ability to explain technical risk to non-technical stakeholders and collaborate across regional teams and time zones. - Proven ability to manage multiple projects and priorities in a fast-paced environment. Preferred - Prior experience as part of a formal CSIRT/SOC escalation function or digital forensics team. - Experience conducting or supporting penetration testing, red team, or purple team exercises. - Industry certifications such as GCIH, GCFA, GCIA, CISSP, GPEN, OSCP, CEH, or equivalent. - Experience working within a global organization with distributed offices and follow-the-sun operational models. - Familiarity with financial services regulatory frameworks (e.g., FCA, FFIEC, NYDFS 23 NYCRR 500, GDPR, MAS TRM, DORA) as they relate to security controls. - Experience securing deal-related technology (virtual data rooms, secure file transfer, confidential collaboration platforms) is a plus given the firm's M&A focus. Soft Skills: - Communicate with clarity and professionalism, balancing accuracy with approachability across a range of audiences. - Demonstrate high emotional intelligence, staying calm, positive, and thoughtful in challenging situations — particularly during high-pressure incident response scenarios. - Approach work with curiosity and a growth-oriented mindset, continuously building security and technical expertise and sharing that knowledge with the wider team. - Operate with a high degree of professionalism and dependability, with a commitment to the firm's mission and values. - Influence without authority, building trust and consensus with stakeholders across IT, the business, and regional leadership. - Stay comfortable working with AI-enabled security, detection, and analytics tools, using them to streamline monitoring, investigations, and reporting. - Bring curiosity to new technologies, proactively identifying opportunities to automate or streamline security workflows. We are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability, gender identity, sexual orientation, protected veteran status, or any other characteristic protected by law.